Add reusable Debian and Ubuntu hardening playbooks

playbooks/harden.yml

@@ -0,0 +1,52 @@
+---
+- name: Apply operating-system, SSH, Fail2ban, and UFW hardening
+  hosts: debian_servers
+  become: true
+  gather_facts: true
+  serial: 1
+
+  pre_tasks:
+    - name: Require a supported Debian or Ubuntu system
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution in ["Debian", "Ubuntu"]
+          - ansible_service_mgr == "systemd"
+        fail_msg: >-
+          This playbook targets Debian or Ubuntu hosts using systemd. Review
+          the inventory and platform facts before applying it elsewhere.
+
+    - name: Confirm UFW is configured to preserve the current SSH path
+      ansible.builtin.assert:
+        that:
+          - ansible_port | default(22) | int == ssh_port | int or (ssh_keep_legacy_port | bool and ansible_port | default(22) | int == ssh_legacy_port | int)
+        fail_msg: >-
+          Keep the current Ansible connection port in sshd and UFW during the
+          first run. After confirming the new port works, update ansible_port
+          and rerun with ssh_keep_legacy_port=false.
+
+  roles:
+    - role: baseline
+      tags: [baseline]
+    - role: hardening
+      tags: [hardening, ssh, fail2ban, ufw]
+
+  handlers:
+    - name: Restart active SSH socket after reloading systemd
+      ansible.builtin.systemd_service:
+        name: ssh.socket
+        daemon_reload: true
+        state: restarted
+      listen: Apply SSH changes
+      when: hardening_ssh_socket.rc == 0
+
+    - name: Reload ssh
+      ansible.builtin.service:
+        name: ssh
+        state: reloaded
+      listen: Apply SSH changes
+      when: hardening_ssh_socket.rc != 0 or hardening_ssh_service.rc == 0
+
+    - name: Restart fail2ban
+      ansible.builtin.service:
+        name: fail2ban
+        state: restarted